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EuroCommerce 


EuroCommerce is the voice for over 5 million retail, wholesale, and other trading companies. Our 
members include national federations in 31 countries, Europe’s 35 leading retail and wholesale 
companies, and federations representing specific retail and wholesale sectors. 


Introduction 


EuroCommerce welcomes the opportunity to provide a contribution to the public consultation on 
guideline 8/2020 on the targeting of social media users. Covid-19 and the restrictions resulting from 
it have accelerated the digital transformation at unprecedented pace. Consumers are increasingly 
turning to online purchases, and this trend is likely to be permanent and growing. Retailers and 
social media platforms play a complimentary role, with social media providing visibility of products 
to consumers and pointers to where to buy. In turn, retailers use social media platforms to reach out 
to relevant consumers, but in most cases, retailers do not gain access by this means to information 
on the identity of the data subjects. Even though both retail companies and social media providers 
have active roles in the online advertisement environment, targeters have little or no influence over 
the development of the services and this aspect should be clearly reflected when developing 
guidelines on involved parties’ responsibility and liability. 


Below we summarise our key recommendations and detailed comments which we hope will be 
helpful. 


Our key recomendations 


e Accountability for data processing should be based with the degree of control over the 
purpose and means of data processing. Market players who have no control or 
influence over the processing of data should not be held accountable for how such data 
is processed. Currently their is a clear inbalance between the parties. 


e Clear and specific differentiation between the responsibility and liability of the social 
media platform provider and the targeter. Currently, the definition of the roles of the 
social media platform and the targeter is unclear. There is an urgent need for further 
clarification of the roles and relationship between the social media platform and 
targeter take and their respective responsibilities and liability. 


e The use of legitimate interest in the social media context does not necessarily lead to 
worse protection of data subjects’ fundamental rights. 


e Stronger cooperation between national DPAs. Divergent national interpretation of the 
CJEU judgment will lead to confusion and legal uncertainty to market players. More 
harmonisation and cooperation between different DPA’s is necessary to avoid this. 
Publicaton of the final EDPB guidelines and guidance to complement the CJEU judgment 
will provide such clarity, and DPAs should await these rather than take national 
decisions. 
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e On paragraph 5: EuroCommerce believes that shared controllership between social media 
providers and other actors provided for in the CJEU ruling will not provide data subjects with 
strengthened or additional protection. Imposing joint controllership could lead to additional 
confusion and lack of clarity. Retailers (who fall under the definition of ‘other actors’) do not 
normally have control, influence, or power of decision over data processing. This instead lies 
with the social media provider, as do decisions on the provision of services to advertisers. 
Targeters rely on the data categories offered by social media providers and have no freedom 
or access to choose in these data sets. They get what they are given on a take it or leave it 
basis. For these reasons, we believe clearly that controllership and data processing 
responsibility should lie solely with the social media platform operator. 


e On paragraph 6: There is a lot of unclarity and open questions regarding the liability and the 
responsibility of social medial platform, as well as which roles and responsibilities they take. 
It would be welcomed to have more clarity on different responsibilities and liability of social 
media service providers. 


RISKS TO THE RIGHTS AND FREEDOMS OF USERS POSED BY THE PROCESSING OF 
PERSONAL DATA 


e On paragraph 8: The introduction of the concept of ‘significant risk’ in paragraph 8 of the 
current draft Guidelines opens wide scope for varying interpretation. The level of risk for 
data subjects can vary significantly, depending on the data subject’s knowledge and overall 
understanding of what the data processing involves. A wrong interpretation by a national 
DPA or others could have a negative impact on the future development of online services. 
We would therefore ask for more detailed criteria for defining a significant risk to leave no 
room for misuse or misinterpretation. 


e On paragraph 9:\We understand the concerns set out in the draft guidance regarding 
personal data uses that could go beyond individuals’ reasonable expectations. However, the 
guidance needs to take into consideration the wide variation in individual expectations of 
data subjects, depending on their age and gender. It also depends on the type of webpage, 
and its purpose of its use by the data subject. This can be particularly true for companies’ 
loyalty programmes: a data subject’s reasonable expectations can depend on the 
information they were provided with when registering in the programme. A data subject’s 
reasonable expectations can change quite quickly, and this can often happen while using a 
webpage. It can therefore be hard to define reasonable expectations ahead of time. 
Additionally, the call for more transparency in the guideline should take full account of 
existing or recently adopted consumer protection rules under e.g. the Omnibus Directive 
(New Deal for Consumers) that already require more transparent provision of information to 
consumers (data subjects). Transparency and sharing information can be useful if the right 
information is shared; unfortunately, as things stand data subjects risk being overloaded 
with information that they do not have time to process and make use of, thus negating the 
purpose of such transparency. We would welcome guidelines on best practice in consistent 
and practical sharing of information. Retailers and wholesalers devote significant resource to 
making the consumer experience more enjoyable, and provide consumers with the 
necessary information. We believe that there is the need for more clarity and means to 
address the lack of transparency between different actors regarding the processing 
obligation. 


ACTORS AND ROLES 


e On paragraph 22, 32, 33: We agree with the draft Guidelines on data gathering powers of 
social media providers. Social media providers have the power to generate a large amount 
of data, and importantly, targets do not have access to this data nor to data about social 
media users. The targeter have no decision powers and do not conduct any data processing 
of their own, other than the collection and transfer of personal data to the social media 
provider. An evaluation of the different stages of data processing could be a potential 
starting point for defining where the liability and responsibility of one actor ends and the 
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other starts. 


e On paragraph 32 and 34 (in particular): This paragraph of the Guidelines introduces joint 
controllership for data processing and causes us particular difficulty. As explained above, the 
roles of different actors and their degree of control differ widely. To impose an assumption 
of joint controllership would be unreasonable where actors’ roles are not equal, which is the 
case currently. A social media provide has full decision-making powers, full access to, and 
ability to gather and process personal data. In contrast, the targeter has no decision power 
and no access to data being processed by the social media provider, thus rendering its ability 
to comply with the rules impossible. This lack of requested information required by GDPR 
and ePrivacy Directive when processing data, and the lack of scope to negotiate the 
provisions of social media platforms’ standard contracts leave the targeter the option only 
of taking it or leaving it. Joint controllership is unreasonable to impose on an actor with no 
access to or control of all data processing steps. Controllers may be involved at different 
stages and to different degrees and it is important to carefully consider the various stages of 
processing of personal data before determining the involved parties’ responsibility and 
liability. This can be a challenge. Because the social media services are offered on a “take it 
or leave it” basis, the targeter has no possibility to offer transparency to data subjects 
regarding the parties’ responsibilities arising from joint controllership. Consequently, 
targeters are can only refer data subjects to the data controls already offered within the 
social media services. 


ANALYSIS OF DIFFERENT TARGETING MECHANISMS 


e On paragraph 45: In the case of legitimate interest, transparency duties in terms of the data 
subject’s opportunity to object before the processing is initiated will raise major challenges 
to retailers and wholesalers. We can always put information on a web page or in the mobile 
app, but we also know that users only read these provisions and react - if at all - when he or 
she receives a message, i.e. after the processing is done, and therefore too late to object. 


e On paragraph 53: Many retail companies offer their customers a loyalty programme with 
various benefits. These are essential way for retailers to provide a relevant experience and 
for them to stay competitive on a global and national market. In providing members with 
clear information about the benefits offered before a customer decides to join the loyalty 
programme, Article 6(1)(b) can serve as an appropriate legal basis for the processing 
necessary to deliver the benefits set out in the terms and conditions. For example, 
communication regarding relevant offers and discounts on products that the member likes, 
both on the retail company’s own website or third-party websites (e.g. a social media 
platform). In several examples, the EDPB has stated that Article 6(1)(b) cannot be used, yet 
this would seem to negate the possible use of legitimate interest as an appropriate legal 
basis for the processing of personal data related to the targeting on social media platforms. 
We would welcome clarification that Article 6(1)(b) may be used as a legal basis provided 
that the processing is necessary to fulfill the commitments set out in the loyalty program 
contract, and that communication on the retailer’s own website and third party websites 
(e.g. a social media platform) is necessary to providing the member with a relevant service, 
and that the retailer in this instance complies with the GDPR fundamental principles e.g. as 
set out in Article 5. Once again, we want to stress the importance of not creating an online 
environment where consumers are overwhelmed with the information presented to them. It 
is common knowledge that data subjects are starting to experience “consent fatigue” when 
using online services. This results in data subjects submitting their consent without 
understanding the implications of their consent. We would welcome further guidance and 
clarifications on measures, such as best practice regarding information, data controls, and 
controls for exercising data subjects’ rights, in general and especially measures that need to 
be implemented to be able to rely on “legitimate interest” as a legal basis. 


e On paragraph 68: In the case of joint controllers, it is clear elsewhere that each must ensure 
that they have a legal basis for the processing. Yet this paragraph contradicts this by stating 
that one of the controllers can be in charge of collecting consent. 
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JOINT CONTROLLERSHIP AND RESPONSIBILITY 


On paragraph 126: These guidelines and recent judgments put targeters in a very difficult 
position, and we are concerned that the guidelines alone will not achieve what they intend. 
We need the guidelines to reflect the reality of targeters’ position and help them to 
adequately protect their customers’ personal data in an unequal bargaining position in 
which media platforms hold all the cards. 


Additional calls for clarification 


Contact: 


EuroCcommerce members would very much appreciate the opportunity to receive a 
clarification of the interaction between the upcoming Guidance on the targeting of social 
media users and the ePrivacy Directive, in particular, Article 13 of the latter. 


While the guidance provides a good description of the groups of actors, we miss any 
examples of the role and responsibilities of “other relevant actors” (agencies, ad networks, 
brokers, etc), and would welcome these to be properly defined and examples given in the 
upcoming EDPB’s Guideline. If the further upcoming Guidelines what to be useful and used 
in practice they need to provide examples were the “other relevant actors” are included. 


We would welcome further guidance on best practices how to obtain consent. It would be 
very important to have examples that reflect everyday situations and real-life experience, 
for example when placing cookies on website. 


Ena Salihovic - +32 2 737 05 83 - salihovic@eurocommerce.eu Transparency Register ID: 84973761187-60 
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